| 199.120.69.158/data/043af8617ca482b8/edgedl.me.gvt1.com/edgedl/release2/update2/exe3fpiw52k2rjbiw7ywfjccju_1.3.36.312/GoogleUpdateSetup.exe |  199.120.69.158 | 302 Found | 0 B |
URL User Request GET HTTP/1.1199.120.69.158/data/043af8617ca482b8/edgedl.me.gvt1.com/edgedl/release2/update2/exe3fpiw52k2rjbiw7ywfjccju_1.3.36.312/GoogleUpdateSetup.exe IP199.120.69.158:80 ASN#53347 PREMIER-COMMUNICATIONS
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO Executable Download from dotted-quad Host |
GET /data/043af8617ca482b8/edgedl.me.gvt1.com/edgedl/release2/update2/exe3fpiw52k2rjbiw7ywfjccju_1.3.36.312/GoogleUpdateSetup.exe HTTP/1.1
Host: 199.120.69.158
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Wed, 01 Nov 2023 18:17:08 GMT
Content-Length: 0
Connection: keep-alive
Location: http://edgedl.me.gvt1.com/edgedl/release2/update2/exe3fpiw52k2rjbiw7ywfjccju_1.3.36.312/GoogleUpdateSetup.exe
Cache-Control: no-cache
X-Content-Type-Options: nosniff
Server: nginx
X-OC-Service-Type: lo
|
| ocsp.pki.goog/s/gts1d4/w27otEXFtQQ | 142.250.74.131 | | 472 B |
URL ocsp.pki.goog/s/gts1d4/w27otEXFtQQ IP142.250.74.131:0
Hash66b0e80aab444141a06b1d778e4fbced f207911f76c106af1ffc2093521f4d1d07dd2c05 7214d21adff89b41d9cc6af55f456c93d9b3f6bcf534a08ba23bbfb11690ee6b
POST /s/gts1d4/w27otEXFtQQ HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 01 Nov 2023 18:17:08 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
| edgedl.me.gvt1.com/edgedl/release2/update2/exe3fpiw52k2rjbiw7ywfjccju_1.3.36.312/GoogleUpdateSetup.exe | 34.104.35.123 | 200 OK | 1.4 MB |
URL User Request GET HTTP/2edgedl.me.gvt1.com/edgedl/release2/update2/exe3fpiw52k2rjbiw7ywfjccju_1.3.36.312/GoogleUpdateSetup.exe IP34.104.35.123:443
CertificateIssuerGoogle Trust Services LLC Subjectedgedl.me.gvt1.com Fingerprint06:04:1D:56:16:A0:17:46:24:F8:CA:27:0A:1D:78:87:DE:3A:E8:0D ValidityTue, 24 Oct 2023 02:31:13 GMT - Thu, 23 Nov 2023 03:27:08 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows\012- data Size1.4 MB (1373744 bytes) Hashe9e3b5be3c160b6eec9499a2698085d9 cfee7354a800a905ad588917fb00b75398fb8515 f4524d644b6291e87f7d185c1c60cfdaf57c78023defeff4c3f3b717d94bbbc7
GET /edgedl/release2/update2/exe3fpiw52k2rjbiw7ywfjccju_1.3.36.312/GoogleUpdateSetup.exe HTTP/1.1
Host: edgedl.me.gvt1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-disposition: attachment
content-security-policy: default-src 'none'
server: Google-Edge-Cache
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-request-id: 47901467-c103-4c97-97c9-189c79808455
content-length: 1373744
date: Wed, 01 Nov 2023 09:27:39 GMT
age: 31769
last-modified: Sat, 02 Sep 2023 01:47:21 GMT
etag: "1a02627"
content-type: application/octet-stream
alt-svc: clear
cache-control: public,max-age=86400
X-Firefox-Spdy: h2
|